From 13b246d3c230d1d2c8802cda40b7fef34fd9707b Mon Sep 17 00:00:00 2001 From: Microsoft Graph DevX Tooling Date: Fri, 23 Oct 2026 12:53:26 -0700 Subject: [PATCH] ci: migrate production build to official 1ES template Separate SDK build and tests from opt-in release artifact publication. Preserve the Node.js matrix and Linux build, and document pipeline authorization and downstream artifact compatibility. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .azure-pipelines/ci-build-production.yml | 182 ++++++++++++++--------- CONTRIBUTING.md | 14 ++ 2 files changed, 124 insertions(+), 72 deletions(-) diff --git a/.azure-pipelines/ci-build-production.yml b/.azure-pipelines/ci-build-production.yml index f091b9c09..e4cbf0a1a 100644 --- a/.azure-pipelines/ci-build-production.yml +++ b/.azure-pipelines/ci-build-production.yml @@ -1,10 +1,11 @@ -# Node.js -# Build a general Node.js project with npm. -# Add steps that analyze code, save build artifacts, deploy, and more: -# https://docs.microsoft.com/azure/devops/pipelines/languages/javascript - name: $(BuildDefinitionName)_$(SourceBranchName)_$(Date:yyyyMMdd)$(Rev:.r) +parameters: + - name: publishReleaseArtifact + displayName: Publish release-drop for the external release pipeline (manual main runs only) + type: boolean + default: false + trigger: branches: include: @@ -12,77 +13,114 @@ trigger: pr: none -stages: -- stage: "Test" - jobs: - - job: +resources: + repositories: + - repository: 1ESPipelineTemplates + type: git + name: 1ESPipelineTemplates/1ESPipelineTemplates + ref: refs/tags/release + +extends: + template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates + parameters: pool: - vmImage: windows-latest - strategy: - matrix: - Node 22: - NODE_VERSION: '22.x' - Node 24: - NODE_VERSION: '24.x' - Node 26: - NODE_VERSION: '26.x' - maxParallel: 2 - steps: - - template: ./common-templates/security-pre-checks.yml - - task: UseNode@1 - inputs: - version: $(NODE_VERSION) - displayName: 'Install Node.js' + name: Azure-Pipelines-1ESPT-ExDShared + image: windows-latest + os: windows - - script: npm ci - displayName: 'npm install for tests' - - script: npm run build - displayName: 'npm build for tests' - - script: npm run test - displayName: 'Run the node tests' - - script: npm run karma - displayName: 'Run karma tests' + stages: + - stage: Build + displayName: Build and test SDK + jobs: + - job: Test + displayName: Test supported Node.js versions + strategy: + matrix: + Node22: + NODE_VERSION: '22.x' + Node24: + NODE_VERSION: '24.x' + Node26: + NODE_VERSION: '26.x' + maxParallel: 2 + steps: + - checkout: self + - task: UseNode@1 + inputs: + version: $(NODE_VERSION) + displayName: Install Node.js - - task: PublishTestResults@2 - displayName: 'Publish Unit Test Results' - inputs: - testResultsFormat: 'JUnit' - testResultsFiles: '**/testResult.xml' - failTaskOnFailedTests: true + - script: npm ci + displayName: Install test dependencies + - script: npm run build + displayName: Build SDK for tests + - script: npm test + displayName: Run Node.js and browser tests - - template: ./common-templates/security-post-checks.yml + - task: PublishTestResults@2 + displayName: Publish unit test results + condition: succeededOrFailed() + inputs: + testResultsFormat: JUnit + testResultsFiles: '**/testResult.xml' + testRunTitle: Node.js $(NODE_VERSION) + failTaskOnFailedTests: true -- stage: "Build" - jobs: - - job: - - pool: - vmImage: ubuntu-latest - steps: - - task: UseNode@1 - inputs: - version: '22.x' - displayName: 'Install Node.js' + - job: BuildPackage + displayName: Build production artifact + pool: + name: Azure-Pipelines-1ESPT-ExDShared + image: ubuntu-latest + os: linux + templateContext: + outputs: + - output: pipelineArtifact + displayName: Publish SDK build for validation + artifactName: sdk-build + targetPath: $(Build.ArtifactStagingDirectory) + steps: + - checkout: self + - task: UseNode@1 + inputs: + version: '22.x' + displayName: Install Node.js - - script: | - npm ci - npm run build - displayName: 'Build for production artifact' - - task: CopyFiles@2 - inputs: - sourceFolder: '$(Build.SourcesDirectory)' - targetFolder: $(Build.ArtifactStagingDirectory) - Contents: | - **/* - !.azure-pipelines/** - !.github/** - !.git/** - !.vscode/** - displayName: 'Copy npm package' + - script: npm ci + displayName: Install production build dependencies + - script: npm run build + displayName: Build production SDK + - task: CopyFiles@2 + inputs: + sourceFolder: $(Build.SourcesDirectory) + targetFolder: $(Build.ArtifactStagingDirectory) + Contents: | + **/* + !.azure-pipelines/** + !.github/** + !.git/** + !.vscode/** + displayName: Stage npm package - - task: PublishBuildArtifacts@1 - inputs: - pathtoPublish: $(Build.ArtifactStagingDirectory) - artifactName: "release-drop" - displayName: 'Publish artifacts' - + - stage: Publish + displayName: Publish release artifact + dependsOn: Build + condition: and(succeeded(), ${{ eq(parameters.publishReleaseArtifact, true) }}, eq(variables['Build.Reason'], 'Manual'), eq(variables['Build.SourceBranch'], 'refs/heads/main')) + jobs: + - job: PublishReleaseArtifact + displayName: Publish validated SDK for external release + pool: + name: Azure-Pipelines-1ESPT-ExDShared + image: ubuntu-latest + os: linux + templateContext: + inputs: + - input: pipelineArtifact + artifactName: sdk-build + targetPath: $(Build.ArtifactStagingDirectory) + outputs: + - output: pipelineArtifact + displayName: Publish release-drop + artifactName: release-drop + targetPath: $(Build.ArtifactStagingDirectory) + steps: + - checkout: none diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index d296d5461..e5d3d1f5d 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -136,6 +136,20 @@ To run linting, npm run lint ``` +#### Production pipeline + +The Azure DevOps production pipeline in `.azure-pipelines/ci-build-production.yml` extends `v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates`. The official template manages SDL scanning and artifact publication instead of the legacy security-check step templates. + +The **Build** stage tests the SDK on Windows with Node.js 22, 24, and 26, and builds the production SDK on Linux with Node.js 22. It publishes an intermediate `sdk-build` pipeline artifact for inspection. Pushes to `main` run this stage without publishing `release-drop`. + +To validate the migration before merging, manually queue **Graph JS SDK Build pipeline** against the PR branch and leave **Publish release-drop for the external release pipeline** unchecked. An Azure DevOps administrator may need to authorize the `1ESPipelineTemplates/1ESPipelineTemplates` repository and the `Azure-Pipelines-1ESPT-ExDShared` pool for this pipeline. Confirm that the pool provides the Windows and Ubuntu images used here, including Chrome for the Windows browser tests, and that the template's SDL checks pass. + +After a successful validation and merge, manually queue the pipeline against `main` with **Publish release-drop for the external release pipeline** checked. The separate **Publish** stage runs only after the build and tests succeed, and only for manual runs on `main`. It republishes the same `sdk-build` contents as `release-drop` without rebuilding or installing dependencies. This pipeline does not publish to npm. + +`release-drop` is now a Pipeline Artifact rather than the Build Artifact produced by `PublishBuildArtifacts@1`. Before enabling publication, confirm the external release pipeline can download Pipeline Artifacts and triggers only on runs with `release-drop` (not build-only runs with `sdk-build`). Update its artifact download and trigger configuration if needed. The artifact name and staged file layout are unchanged. + +#### Commit your changes + The files in `C:\Users\\` are a working copy of the new branch that you created in your local repository. Changing anything in this folder doesn't affect the local repository until you commit a change. To commit a change to the local repository, type the following commands in GitBash: git add .